dsh-security-suite

English · 中文

A native security assessment suite for DeepSeek Harness (DSH), adapted from the architecture of openai/codex-security (Apache-2.0).

It runs repository, diff, and deep security scans inside DSH: LLM review subagents do the discovery (baseline auditors, focused investigators, file-review and deep workers), while a deterministic engine produces the evidence baseline, and every reportable finding is bound to a claim-token validation receipt and an attack-path receipt before it can be finalized.

Quick start

npm install
npm run build
dsh plugin --profile web add /absolute/path/to/dsh-security-suite

dsh run "Run a deep security scan, validate candidates, trace attack paths, and produce a report for this workspace."

Capabilities

See the full tool surface and evidence model in docs/evidence-contract.md.

How discovery works

• Standard (discovery: llm, default): the plugin freezes an in-scope worklist from scan receipts, launches one independent baseline auditor subagent, builds a source-backed threat map, groups review questions into investigation packets, and runs one focused investigator subagent per packet. Every candidate must cite a receipted in-scope location.
• Diff (discovery: llm, default): each changed source file is assigned to one restricted file-review subagent that reads it in full.
• Deep: six workers per round with distinct lenses (forward dataflow, backward from sinks, authorization logic, open-ended, parsers, secrets) review immutable 200-line regions; a semantic reducer subagent merges equivalent candidates across workers; saturation requires stopAfterNoNew consecutive zero-novelty rounds.
• Engine (discovery: engine): the deterministic rule/AST/flow engine for JS/TS, Python, Go, Java, C#, PHP, Ruby, C, C++, and Rust.

Discovery never auto-confirms vulnerabilities. A finding becomes reportable only after a source-backed validation receipt and a separately claimed attack-path receipt.

Configuration

config:
  enabled: true
  maxFiles: 500
  maxFileBytes: 262144
  deepScan:                 # deep-scan engine (codex-security semantics)
    workers: auto           # positive integer, or 'auto' (capped at 6)
    stopAfterNoNew: 6       # saturate after this many zero-novelty rounds
    maxDiscoveryRuns: 60
    maxTimeHours: 96
  knowledgeBase: []         # files/dirs of Markdown or plain text, read-only
  scanPrompt: ''            # extra instructions for every LLM discovery worker

State is placed under DSH_SECURITY_SUITE_STATE_DIR or stateDir (default ~/.dsh-security-suite); the engine confines repository and knowledge-base paths to the active workspace.

Documentation

• docs/evidence-contract.md — the evidence model, receipts, coverage semantics, and per-rule analysis boundaries
• MIGRATION.md — the codex-security capability matrix and migration status

Attribution

Worker prompt templates, canonical scan-contract field trees, severity policy, and deep-scan configuration semantics are adapted from openai/codex-security (Apache-2.0). No third-party security-runtime source code or dependency is executed.

License

Apache-2.0.